merge fix for CVE-2019-14378